Best Employee Management System EUVD-2026-60049

Q: What is the CVSS score of EUVD-2026-60049?

EUVD-2026-60049 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-19987 MEDIUM

Exposure of Information Through Directory Listing (CWE-548)

2026-08-17 VulDB

GHSA-wf4g-mq3w-72gf

Information Disclosure Best Employee Management System Sourcecodester

6.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated directory listing with no auth or interaction required; impact bounded to low confidentiality with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 06:00 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in SourceCodester Best Employee Management System 1.0. This affects an unknown function of the file /assets/uploadImage/Profile/. Such manipulation leads to exposure of information through directory listing. It is possible to launch the attack remotely.

AnalysisAI

Directory listing exposure in SourceCodester Best Employee Management System 1.0 allows unauthenticated remote attackers to browse the /assets/uploadImage/Profile/ path and enumerate all uploaded employee profile images without any credentials. The web server returns a browsable file index rather than denying access, leaking filenames, file metadata, and potentially PII-adjacent content tied to employee records. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though exploitation requires nothing more than a standard HTTP GET request.

Technical ContextAI

The vulnerability is rooted in CWE-548 (Information Exposure Through Directory Listing), a web server misconfiguration class where the server is not instructed to deny index generation for upload directories. The affected path /assets/uploadImage/Profile/ is a static file storage location for employee profile images within the application. When directory listing is enabled - either by server default or absent explicit prohibition - any HTTP client can retrieve a full index of stored files. The affected product is identified by CPE cpe:2.3:a:sourcecodester:best_employee_management_system:*:*:*:*:*:*:*:*, a PHP-based web application distributed by SourceCodester, typically deployed on Apache or nginx stacks. The wildcard version segment in the CPE suggests no version-specific bounds have been established by the reporter.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary remediation is to disable directory listing for all upload directories at the web server level: on Apache, add 'Options -Indexes' to the .htaccess file in /assets/ or to the relevant VirtualHost block; on nginx, ensure 'autoindex off;' is set in the location block covering /assets/. A secondary hardening measure is to serve uploaded files through an authenticated PHP controller rather than exposing /assets/ as a directly browsable static path, which eliminates the class of issue entirely and prevents similar exposures in sibling directories. As a compensating control where server reconfiguration is not immediately possible, restrict access to /assets/uploadImage/ via IP allowlist or HTTP authentication at the web server layer. References: https://vuldb.com/vuln/391191 and https://www.sourcecodester.com/.